[PATCH] usb: gadget: udc: Fix overwriting the gadget driver of occupied udc

[Huisong Li]

In gadget_match_driver(), the core only validates whether the gadget
driver is already bound, but it doesn't check the current state of
the UDC. This leads to gadget_bind_driver() (the probe stage) being
invoked for an already occupied UDC.

In gadget_bind_driver(), the code proceeds to overwrite 'udc->driver'
and forcibly modify the UDC speed without checking if the UDC is
currently in use. This results in state inconsistency and disruption
of the existing connection.

Fix this by adding a check for 'udc->driver' in
gadget_bind_driver().

Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets")
Signed-off-by: Huisong Li <lihuisong@xxxxxxxxxx>
---
 drivers/usb/gadget/udc/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index e8861eaad907..47e50fe1b75b 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1615,6 +1615,13 @@ static int gadget_bind_driver(struct device *dev)
 	int ret = 0;
 
 	mutex_lock(&udc_lock);
+	if (udc->driver) {
+		dev_err(&udc->dev, "UDC (%s) is already in use.\n",
+			dev_name(&udc->dev));
+		mutex_unlock(&udc_lock);
+		return -EBUSY;
+	}
+
 	if (driver->is_bound) {
 		mutex_unlock(&udc_lock);
 		return -ENXIO;		/* Driver binds to only one gadget */
-- 
2.33.0